Privacy policy
Draft for legal review. Prepared by the project team for GDPR compatibility; to be reviewed by counsel and completed with the controller's identity before mining launch.
Last updated: to be set at publication.
What we collect and why
| Data | Source | Purpose | Kept for |
| :------------------------------------------------------- | :------------------------ | :-------------------------------------------------------------------- | :-------------------------------- |
| Telegram user ID, username, Premium flag | Telegram initData | Account, leaderboard display name, sign-in | Season + 12 months |
| Claim records (time, amount, multiplier inputs) | Your claims | The ledger itself; computing rewards; publishing the final allocation | Season + 12 months |
| Salted hashes of IP address and device identifier | Your device at claim time | Detecting bot farms (legitimate interest) | Season + 12 months |
| Browser user agent | Your device at claim time | Detecting bot farms; debugging | 90 days |
| Referral relationships | The link you opened | Referral bonuses | Season + 12 months |
| TON wallet address, public key, ownership signature | TON Connect | Verification bonus; delivering your allocation | Until allocation is fully claimed |
| Wallet history summary (age, transaction count, balance) | Public blockchain data | Verification rule | Season + 12 months |
| Fraud scores and review notes | Our systems and reviewers | Sybil prevention | Season + 12 months |
We do not collect your phone number, contacts, messages, or precise location. IP addresses and device identifiers are hashed with a secret salt before storage; we cannot reverse them.
Legal bases (GDPR)
Performance of a contract (running the Service you asked for); legitimate interests (preventing fraud and abuse, securing the Service); legal obligations where applicable.
Sharing
We use infrastructure providers (hosting, database, error monitoring) that process data on our behalf under data processing agreements. Blockchain data you choose to publish (your wallet address, your on-chain claim) is public by nature. We do not sell personal data and do not use advertising trackers.
Publication at snapshot
The final allocation list (wallet address and amount) is published for verification. It does not include Telegram identifiers.
Your rights
Access, rectification, erasure, restriction, portability, and objection, subject to our need to keep fraud-prevention records for the periods above. Contact: [email protected]. You may also complain to your local data protection authority.
Analytics and cookies
This website uses cookie-less, aggregate analytics only. The Mini App stores a session token and a random device identifier in browser storage; neither is a tracking cookie.
Controller
To be completed: entity, address, and data protection contact.